1946: Hawaii

Explain xkcd: It's 'cause you're dumb.
Jump to: navigation, search
Ok, I've got it, just need to plug in my security key. Hmm, which way does the USB go? Nope, not that way. I'll just flip it and-- OH JEEZ IT FELL INTO THE VENT.
Title text: Ok, I've got it, just need to plug in my security key. Hmm, which way does the USB go? Nope, not that way. I'll just flip it and-- OH JEEZ IT FELL INTO THE VENT.


Screenshot of the message. (From Wikimedia Commons)

On January 13, 2018, the state of Hawaii sent out an emergency alert warning of an incoming ballistic missile attack. The message was specifically noted to NOT be a drill. This caused widespread panic and fear amongst the island residents, and there were follow-up confirmations from local entities who thought the original warning was real. It was eventually determined that the alert was sent in error – the explanation being that a technician accidentally sent out the "real" version when they were supposed to be testing the system during an end-of-shift changeover – but the fact that it took around 15 minutes for the correction to be sent drew widespread criticism. On January 23, it was revealed that the governor of Hawaii knew the alert was a false alarm only two minutes after it was sent, but couldn't notify the public because he had forgotten the login information for his Twitter account.

The proliferation of online services requiring authentication, together with variations in security requirements, various flavors of Multi-factor authentication, a variety of password retrieval methods, and security advice not to re-use passwords across services, has resulted in the management and memorization of passwords becoming a major headache for many people. This comic shows Cueball, representing the governor, frantically trying to retrieve his log in to Twitter and encountering a number of common frustrations:

  • He has a number of passwords that he uses, likely for multiple services, but none of them seem to be working. Often people will use subtly different variations of one or more password(s) for different logins since logins may require different password requirements. In a situation where they've forgotten the relevant password, this can lead to them cycling through all the possible variations, and struggling to keep track of which they have and haven't tried.
  • He's requested a password reset, but doesn't know where to go to activate it. Many services allow users to reset a password using a link or information sent to them in an email. However, as many people have multiple email accounts, this can be unhelpful and frustrating if it simply indicates that 'you have been sent an email'.
  • He expects the password to have been saved somewhere, but can't work out where. Many devices and browsers now have the facility to save and/or sync passwords entered through them, in an attempt to simplify their management by providing centralized storage. However, the very number of these available leads to a re-fragmentation.

Off-panel, another person is adding to the stress of his situation by screaming at him that people are beginning to panic and warning sirens are going off, underscoring the need to get the correction out as fast as possible. As the caption under the comic indicates, Randall has had a nightmare along these (very specific) lines, and is amused to find someone experiencing that nightmare in the real world.

The title text refers to USB security keys, physical USB devices that act as tangible 'passwords' for various accounts or devices. (A traditional key of shaped metal is literally a tangible password, with each digit of the password releasing one tumbler of a physical lock; Electronic keys replace the key-and-tumbler password system with a digital password signal.) In the context of this comic, the governor attempts to sign into his Twitter account using one such key, but can't insert it into his computer correctly (as USB devices are infamous for needing to be inserted in a particular orientation despite having a symmetrical outer appearance; also known as USB superposition.) Trying to flip the key around, Cueball drops it into a vent - similar to what happens in 1518: Typical Morning Routine.


[Cueball is standing, slightly crouched, at a desk with one hand on a laptop and the other holding his phone.]
Off-screen voice: Hurry!
Cueball: It keeps saying "Wrong Password!" I've tried everything it might be!
Off-screen voice: The clock is ticking!
Cueball: I requested a reset but haven't gotten it! Which email did I use?!
Off-screen voice: Sirens are going off!!
Cueball: It's not in my password manager! Is it in a browser? Which browser? Is Autofill synced to my phone??
Off-screen voice: OH MY GOD THE SCREAMING!!
[Caption below the panel:]
I feel bad for everyone in Hawaii, but when the governor couldn't get into his Twitter account, he lived out one of my very specific nightmares in real life.


The Hawaii emergency agency also might have password problems. In a news article from June 2017 there was a photo showing an agency employee standing beside his own computer, which sports a password on a sticky note. This caused further criticism of the agency security practices.

comment.png add a comment! ⋅ comment.png add a topic (use sparingly)! ⋅ Icons-mini-action refresh blue.gif refresh comments!


OMG - so funny, so timely, so close to home. One of our modern fears, in a crisis what would happen if I forgot the password! Rtanenbaum (talk) 14:02, 24 January 2018 (UTC)

"Created by a TWITTER" Halo422 (talk) 14:28, 24 January 2018 (UTC)

Based on the situation that xkcd is offering, it makes me look like I can't be any governor or an official, since I tend to forget my password very easily, especially my social media ones. RIP me.15:02, 24 January 2018 (UTC)

Most implausible explanation I've ever heard. Why not use something other than a Twitter account to notify people, apparently there's an entire system set up for delivering messages to people's phones, I'm not sure a tweet should be part of the official rollback process. -- Comment Police (talk) (please sign your comments with ~~~~)

Implausible, yet true. It was all over the news. Twitter is currently perceived as an appropriate way to communicate with constituents by many elected officials. I agree that a reverse-911 probably would have been far more effective, but the news would give more coverage to what's on Twitter, regardless (reaches more people, if less directly or immediately, than reverse-911). ProphetZarquon (talk) 18:09, 24 January 2018 (UTC)
The issue (as I understand it) was that the send-everyone-a-text-message system was only programmed with a specific set of messages, and "oops, that was an error, ignore that" wasn't one of them. Most of those 38 minutes were spent adding that new message to the system. In the meantime, people in authority who knew there had been a mistake would have been trying to use any means they could of getting this fact out to the public, such as the governor using his official Twitter account. -- Peregrine (talk) 03:32, 25 January 2018 (UTC)
I'm someone who openly and proudly does not watch or listen to the news (my reasoning is that my knowing all the details of this fire or that hostage situation won't stop it or help it, it'll just add more negative to my life. I get headlines through ads on TV and radio, I feel that's enough for the "history repeating itself" angle), and even I caught this headline. Yeah, an incident was really made worse by a guy unable to access his Twitter. :) NiceGuy1 (talk) 06:12, 26 January 2018 (UTC)

As I am not a native Hawaiian or american, could somebody explain the nature of this warning system please? Does it work with a speaker / sirene system (as is common in Europe) or with text / CB messages? Why was it installed, what is the name of this system etc. That information might give the uninitiated some background information needed to fully understand this comic. 22:00, 24 January 2018 (UTC)

The Hawaii state Emergency Alert system is multilayered. This event started with a text message, sent (in error) to phones. The text message was picked up by broadcast media (radio, television). There is also a siren system, reportedly a separate authorization is required to activate it. In some places, Honolulu especially, the sirens were sounded, apparently without the appropriate authorization. In others, such as Hawaii Island where I live, the sirens did not go off. Official channels did not retract the error until 38 minutes after the initial text. Though Governor Ige did not get his tweet sent, other officials, such as US Rep Tulsi Gabbard, did do so, to little effect. It's therefore an open question whether Ige's message would have made much of a difference.-- 22:48, 24 January 2018 (UTC)
Thank you for the explanation. This, and reading a couple of news articles about it made me got a much clearer picture. It also really drives home how important the work of an UI designer is. 08:50, 28 January 2018 (UTC)
(same user, but apparently a different IP)

USB plugs are 4 dimensional... see https://www.smbc-comics.com/?id=2388. ——

i use android, and am thus irrelevant. but, the twitter app does not seem, uniquely, to allow the caching of passwords and thus requires you to log in every time. assuming i'm not mistaken in this, does the iOS equivalent also require this? -- 13:09, 26 January 2018 (UTC)

I slept through that whole mess because the siren didn't sound where I live. Thankfully, I woke up in a universe where Trump was too busy golfing to start WWIII by mistake. -- 00:16, 27 January 2018 (UTC)